diff options
| author | dkf <donal.k.fellows@manchester.ac.uk> | 2004-02-09 14:48:20 (GMT) |
|---|---|---|
| committer | dkf <donal.k.fellows@manchester.ac.uk> | 2004-02-09 14:48:20 (GMT) |
| commit | 336606efeef781595867d3cd1a7a8c4cfd7c5996 (patch) | |
| tree | aa7e897ab43c04037776f13b81d9d07694de80a1 | |
| parent | fefdd508a8ca659fee8e25f3d7e19e1e0e7d62d6 (diff) | |
| download | tk-336606efeef781595867d3cd1a7a8c4cfd7c5996.zip tk-336606efeef781595867d3cd1a7a8c4cfd7c5996.tar.gz tk-336606efeef781595867d3cd1a7a8c4cfd7c5996.tar.bz2 | |
Stop crashes when copying a large photo to itself causes resizing. [Bug 877950]
| -rw-r--r-- | ChangeLog | 7 | ||||
| -rw-r--r-- | generic/tkImgPhoto.c | 8 | ||||
| -rw-r--r-- | tests/imgPhoto.test | 10 |
3 files changed, 23 insertions, 2 deletions
@@ -1,3 +1,10 @@ +2004-02-09 Donal K. Fellows <donal.k.fellows@man.ac.uk> + + * generic/tkImgPhoto.c (Tk_PhotoPutBlock, Tk_PhotoPutZoomedBlock): + * tests/imgPhoto.test (imgPhoto-16.1): Better handling of the case + when copying from one area of a photo to another triggers a + resizing of the image. [Bug 877950] + 2004-02-07 David Gravereaux <davygrvy@pobox.com> * win/makefile.vc: diff --git a/generic/tkImgPhoto.c b/generic/tkImgPhoto.c index 3b3574e..d5bf02d 100644 --- a/generic/tkImgPhoto.c +++ b/generic/tkImgPhoto.c @@ -17,7 +17,7 @@ * Department of Computer Science, * Australian National University. * - * RCS: @(#) $Id: tkImgPhoto.c,v 1.43 2004/01/13 02:06:00 davygrvy Exp $ + * RCS: @(#) $Id: tkImgPhoto.c,v 1.44 2004/02/09 14:48:20 dkf Exp $ */ #include "tkInt.h" @@ -4291,6 +4291,7 @@ Tk_PhotoPutBlock(interp, handle, blockPtr, x, y, width, height, compRule) xEnd = x + width; yEnd = y + height; if ((xEnd > masterPtr->width) || (yEnd > masterPtr->height)) { + int sameSrc = (blockPtr->pixelPtr == masterPtr->pix32); if (ImgPhotoSetSize(masterPtr, MAX(xEnd, masterPtr->width), MAX(yEnd, masterPtr->height)) == TCL_ERROR) { if (interp != NULL) { @@ -4300,6 +4301,10 @@ Tk_PhotoPutBlock(interp, handle, blockPtr, x, y, width, height, compRule) } return TCL_ERROR; } + if (sameSrc) { + blockPtr->pixelPtr = masterPtr->pix32; + blockPtr->pitch = masterPtr->width * 4; + } } if ((y < masterPtr->ditherY) || ((y == masterPtr->ditherY) @@ -4610,6 +4615,7 @@ Tk_PhotoPutZoomedBlock(interp, handle, blockPtr, x, y, width, height, } if (sameSrc) { blockPtr->pixelPtr = masterPtr->pix32; + blockPtr->pitch = masterPtr->width * 4; } } diff --git a/tests/imgPhoto.test b/tests/imgPhoto.test index 4a5eead..fe8228d 100644 --- a/tests/imgPhoto.test +++ b/tests/imgPhoto.test @@ -9,7 +9,7 @@ # # Author: Paul Mackerras (paulus@cs.anu.edu.au) # -# RCS: @(#) $Id: imgPhoto.test,v 1.16 2003/04/01 21:06:37 dgp Exp $ +# RCS: @(#) $Id: imgPhoto.test,v 1.17 2004/02/09 14:48:20 dkf Exp $ package require tcltest 2.1 eval tcltest::configure $argv @@ -655,6 +655,14 @@ test imgPhoto-15.1 {photo images can fail to allocate memory gracefully} \ list [catch {image create photo -width 32000 -height 32000} msg] $msg } {1 {not enough free memory for image buffer}} +test imgPhoto-16.1 {copying to self doesn't access freed memory} { + # Bug 877950 makes this crash when trying to copy out of a deallocated area + set photo [image create photo] + $i put red -to 0 0 1000 1000 + $i copy $i -from 0 0 1000 1000 -to 500 0 + image delete $i +} {} + destroy .c eval image delete [image names] |